linux-toradex.git/drivers/input/ff-core.c, branch v4.18-rc4

Input: uinput - avoid FF flush when destroying device

2017-09-21T23:31:22+00:00

Normally, when input device supporting force feedback effects is being
destroyed, we try to "flush" currently playing effects, so that the
physical device does not continue vibrating (or executing other effects).
Unfortunately this does not work well for uinput as flushing of the effects
deadlocks with the destroy action:

- if device is being destroyed because the file descriptor is being closed,
  then there is noone to even service FF requests;

- if device is being destroyed because userspace sent UI_DEV_DESTROY,
  while theoretically it could be possible to service FF requests,
  userspace is unlikely to do so (they'd need to make sure FF handling
  happens on a separate thread) even if kernel solves the issue with FF
  ioctls deadlocking with UI_DEV_DESTROY ioctl on udev->mutex.

To avoid lockups like the one below, let's install a custom input device
flush handler, and avoid trying to flush force feedback effects when we
destroying the device, and instead rely on uinput to shut off the device
properly.

NMI watchdog: Watchdog detected hard LOCKUP on cpu 3
...
 <>  [] _raw_spin_lock_irqsave+0x37/0x40
 [] complete+0x1d/0x50
 [] uinput_request_done+0x3c/0x40 [uinput]
 [] uinput_request_submit.part.7+0x47/0xb0 [uinput]
 [] uinput_dev_erase_effect+0x5b/0x76 [uinput]
 [] erase_effect+0xad/0xf0
 [] flush_effects+0x4d/0x90
 [] input_flush_device+0x40/0x60
 [] evdev_cleanup+0xac/0xc0
 [] evdev_disconnect+0x2b/0x60
 [] __input_unregister_device+0xac/0x150
 [] input_unregister_device+0x47/0x70
 [] uinput_destroy_device+0xb5/0xc0 [uinput]
 [] uinput_ioctl_handler.isra.9+0x65e/0x740 [uinput]
 [] ? do_futex+0x12b/0xad0
 [] uinput_ioctl+0x18/0x20 [uinput]
 [] do_vfs_ioctl+0x298/0x480
 [] ? security_file_ioctl+0x43/0x60
 [] SyS_ioctl+0x79/0x90
 [] entry_SYSCALL_64_fastpath+0x12/0x71

Reported-by: Rodrigo Rivas Costa 
Reported-by: Clément VUCHENER 
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=193741
Signed-off-by: Dmitry Torokhov

Input: document and check on implicitly defined FF_MAX_EFFECTS

2015-10-16T22:32:16+00:00

There is an undocumented upper bound for the total number of ff effects:
    FF_GAIN (= 96).
This can be found as follows:
- user: write(EV_FF, effect_id, iterations)
    calls kernel: ff->playback(effect_id, ...): starts effect "effect_id"
- user: write(EV_FF, FF_GAIN, gain)
    calls kernel: ff->set_gain(gain, ...): sets gain

A collision occurs when effect_id equals FF_GAIN.
According to input_ff_event(),
FF_GAIN is the smallest value where a collision occurs.
Therefore the greatest safe value for effect_id is FF_GAIN - 1,
and thus the total number of effects should never exceed FF_GAIN.

Define FF_MAX_EFFECTS as FF_GAIN and check on this limit in ff-core.

Signed-off-by: Elias Vanderstuyft 
Signed-off-by: Dmitry Torokhov

Input: ff-core - silence an underflow warning

2015-09-29T23:09:36+00:00

My static checker complains that "value" comes from the user in
evdev_do_ioctl() and we check that it's not too large here but we don't
check that it's negative.  It's harmless because the ->set_gain() and
->set_autocenter() functions truncate it to a valid u16 value, but we
may as well fix it just to make the static checker happy.

Signed-off-by: Dan Carpenter 
Signed-off-by: Dmitry Torokhov

Input: ff-core - use for_each_set_bit where appropriate

2015-07-09T04:50:59+00:00

Use for_each_set_bit to check for set bits in bitmap
as it is more efficient than checking individual bits.

Signed-off-by: Anshul Garg 
Signed-off-by: Dmitry Torokhov

Input: ff-core - fix typo in comment to input_ff_erase()

2015-05-20T21:45:42+00:00

Signed-off-by: Shailendra Verma 
Signed-off-by: Dmitry Torokhov

Input: ff-core - fix spelling mistake in ff-core

2015-05-08T23:35:58+00:00

Fix spelling of magnitude
s/manginude/magnitude

Signed-off-by: Dan Murphy 
Signed-off-by: Dmitry Torokhov

Input: ff-core - use new debug macros

2015-04-14T21:29:49+00:00

Replace old pr_* with dev_* debugging macros

Signed-off-by: Oliver Neukum 
Signed-off-by: Dmitry Torokhov

Input: random formatting fixes

2012-08-22T05:29:49+00:00

Fixes for some coding style issues reported by scripts/checkpatch.pl
utility.

Signed-off-by: Baodong Chen 
Signed-off-by: Dmitry Torokhov

Input: force feedback - potential integer wrap in input_ff_create()

2011-10-13T04:13:11+00:00

The problem here is that max_effects can wrap on 32 bits systems.
We'd allocate a smaller amount of data than sizeof(struct ff_device).
The call to kcalloc() on the next line would fail but it would write
the NULL return outside of the memory we just allocated causing data
corruption.

The call path is that uinput_setup_device() get ->ff_effects_max from
the user and sets the value in the ->private_data struct.  From there
it is:
-> uinput_ioctl_handler()
   -> uinput_create_device()
      -> input_ff_create(dev, udev->ff_effects_max);

I've also changed ff_effects_max so it's an unsigned int instead of
a signed int as a cleanup.

Signed-off-by: Dan Carpenter 
Signed-off-by: Dmitry Torokhov

Input: use pr_fmt and pr_

2010-12-01T07:10:26+00:00

Signed-off-by: Joe Perches 
Signed-off-by: Dmitry Torokhov